Incident disclosureDisclosed 2025-06-13Zoomcar Holdings, Inc.SEC filing

Zoomcar Holdings, Inc. discloses a cybersecurity incident (SEC 8-K, June 2025)

On June 9, 2025, Zoomcar Holdings, Inc. (the “Company”) identified a cybersecurity incident involving unauthorized access to its information systems.

What happened

  • The Company became aware of the incident after certain employees received external communications from a threat actor alleging unauthorized access to Company data.Form 8-K Item 1.05, Zoomcar Holdings, Inc., filed 2025-06-13
  • Based on preliminary findings, the Company determined that an unauthorized third party accessed a limited dataset containing certain personal information of a subset of approximately 8.4 million users, including names, phone numbers, car registration numbers, personal addresses and email addresses associated with such users.Form 8-K Item 1.05, Zoomcar Holdings, Inc., filed 2025-06-13
  • The Company is also engaging with third-party cybersecurity experts to further assist with the investigation.Form 8-K Item 1.05, Zoomcar Holdings, Inc., filed 2025-06-13

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern